Firstly enable lighting and draw a triangle; Then set GL_LIGHT_MODEL_TWO_SIDE as TRUE and  glFrontFace as GL_CW, the driver will cause segment fault when draw then triangle again.
Please run attached test case to reproduced this bug.

The seg fault info:
===================
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1211983152 (LWP 4272)]
0xb7a4efbe in triangle_twoside (ctx=0x8057c00, e0=0, e1=1, e2=2)
    at ../../../../../src/mesa/tnl_dd/t_dd_tritmp.h:198
198                       GLfloat (*vbcolor)[4] = VB->ColorPtr[1]->data;

The backtrace info:
===============================
(gdb) bt
#0  0xb7a4efbe in triangle_twoside (ctx=0x8057c00, e0=0, e1=1, e2=2)
    at ../../../../../src/mesa/tnl_dd/t_dd_tritmp.h:198
#1  0xb7addc5a in _tnl_render_triangles_verts (ctx=0x8057c00, start=0, count=3, 
    flags=52) at tnl/t_vb_rendertmp.h:163
#2  0xb7adf095 in run_render (ctx=0x8057c00, stage=0x80998cc)
    at tnl/t_vb_render.c:320
#3  0xb7adc0d1 in _tnl_run_pipeline (ctx=0x8057c00) at tnl/t_pipeline.c:158
#4  0xb7a41b6b in intelRunPipeline (ctx=0x8057c00) at intel_tris.c:898
#5  0xb7adcd38 in _tnl_draw_prims (ctx=0x8057c00, arrays=0x8087ad8, 
    prim=0x8086634, nr_prims=1, ib=0x0, min_index=0, max_index=2)
    at tnl/t_draw.c:402
#6  0xb7ad5b5e in vbo_exec_vtx_flush (exec=0x8086510) at vbo/vbo_exec_draw.c:215
#7  0xb7ad17d0 in vbo_exec_FlushVertices (ctx=0x8057c00, flags=1)
    at vbo/vbo_exec_api.c:685
#8  0xb7a58c56 in _mesa_Flush () at main/context.c:1737
#9  0xb7ee1912 in glFlush () at ../../../src/mesa/glapi/glapitemp.h:1170
#10 0x08048a09 in Render () at polymode_new.c:33
#11 0x08048a53 in test () at polymode_new.c:50
#12 0x08048aca in display () at polymode_new.c:62
#13 0xb7e7553f in processWindowWorkList (window=0x804eae8) at glut_event.c:1306
#14 0xb7e76012 in glutMainLoop () at glut_event.c:1353
#15 0x08048b46 in main (argc=1, argv=0xbff75094) at polymode_new.c:74